Privacy at Kivo

Kivo is a realtime chat app for private DMs, small groups, and community Spaces — built as a student full-stack project, but designed for real everyday use. This page explains what data Kivo collects, why, and what control you have over it.

If anything here changes in a meaningful way, the Last updated date above will change with it. Continued use of Kivo after a change means you accept the updated page.

Kivo collects the minimum needed to run a chat service. Everything below is provided by you or generated by your use of the app — Kivo does not buy data from brokers or track you across other sites.

• Account: display name, username, email, and a bcrypt-hashed password. Passwords are never stored in readable form.
• Profile (optional): bio, status, avatar photo, banner, country, GitHub username, avatar frame, and theme appearance (accent + canvas tone).
• Content: messages you send (up to 4000 characters), replies, reactions, and file or image attachments you upload.
• Social graph: friend requests, friendships, blocked users, group memberships, and Space memberships with roles.
• Sessions & security: login sessions, verification and password-reset tokens (stored hashed), two-factor secrets and backup codes (hashed), and admin audit entries when moderation acts on an account.
• Device & delivery: push-notification subscriptions (endpoint + keys) per device, online presence, last-active timestamps, and notification preferences.

Your data is used to operate Kivo and nothing else: signing you in, delivering messages realtime over Socket.IO, showing presence and receipts, sending in-app and push notifications, enforcing membership and moderation rules, and keeping accounts secure.

• No advertising, no profiling, no sale of personal data — ever.
• Notification sounds and theme previews render locally in your browser; the server never sees them.
• System messages (joins, leaves, admin actions) are generated to keep chats coherent, never for tracking.

Messages, accounts, and memberships live in MongoDB, which is the authoritative store. Avatar photos and message attachments are stored in Appwrite Storage in separate buckets. Offline push delivery uses VAPID web push; dead push endpoints are deleted automatically.

Transactional email (verification links, password resets) is sent over Gmail SMTP and is fire-and-forget, so it never blocks sign-in.

Sign-in issues a short-lived JWT access token (about 15 minutes) sent in the Authorization header, plus a refresh token in an httpOnly cookie backed by a Session record. Refreshing mints a new access token without rotating the cookie, and deleting the Session (logout, logout everywhere, password reset, or admin ban) revokes access immediately.

The app also keeps local state in your browser: your theme choice, sound toggles, the last chat you had open, and an IndexedDB cache of recent conversations and messages for fast, offline-tolerant starts. Clearing site data removes it; signing out clears the per-user cache.

Kivo does not sell personal data and shares it only where running the service requires it: infrastructure providers that store data on Kivo's behalf (database, file storage, email delivery), and where required by law or to protect users from abuse.

Public information is visible by design: your display name, username, avatar, and public profile page (/u/username) can be seen by other users, and messages you send are visible to the other participants of that chat or Space channel.

Most controls live in the app today — edit your profile, change or remove your avatar, toggle badge visibility, manage blocked users, tune notification and sound preferences, or log out of one or all sessions from your profile.

• Edit or soft-delete your own messages; deleting clears the text while keeping ordering stable for replies.
• Leave any group or Space at any time; private Spaces can only be rejoined with a fresh invite code.
• Block anyone from a DM or profile — friendships are removed and the block is enforced server-side.
• Password reset signs you out everywhere; enabling two-factor adds a TOTP second step plus single-use backup codes.

Passwords are hashed with bcrypt, every request body and param is validated server-side with Zod, auth is resource-based (membership, sender, and role-rank checks on every action), and rate limiting, Helmet headers, and scoped CORS protect the API. Production errors never expose stack traces or secrets.

No system is perfect — Kivo is a student project without a paid security audit. Use a unique password, turn on two-factor, and do not share sensitive documents you cannot afford to lose.

Kivo is not directed at children under 13. If you are under 13, do not create an account. If you are under the age of digital consent where you live, use Kivo only with a parent or guardian's permission.

Kivo will update this page as features ship (for example, if new data types like threads or calls arrive). The Last updated date at the top always reflects the current version. For how features actually behave, the Docs page is the practical companion to this policy.